Use defusedxml for untrusted xml data in deserialization

[msyyc]

fix #2825

According to official docs https://docs.python.org/3/library/xml.html#the-defusedxml-package, for untrusted xml data, we shall use defusedxml when deserialization

[iscai-msft]

@msyyc instead of adding a dep on a new library, I think we should just got # nosec like msrest and serialization code are doing right now (ex here). Thanks for doing it this safer way, but I think ultimately we shouldn't add a new library dep if possible, and since this is what we're currently doing, I'm comfortable going the # nosec route

[msyyc]

@msyyc instead of adding a dep on a new library, I think we should just got # nosec like msrest and serialization code are doing right now (ex here). Thanks for doing it this safer way, but I think ultimately we shouldn't add a new library dep if possible, and since this is what we're currently doing, I'm comfortable going the # nosec route

I see and thank you for the context.